Which of the following can you use to configure authorization and trust management in a CAP project? Note: There are 2 correct answers to this question.

Question

Options

• ARole collections in mta.yaml
• BPredefined roles in SAP BTP
• CXSUAA service
• DSAP Cloud Identity Services

• A
  8% (3)
• B
  3% (1)
• C
  89% (32)

Explanation

In CAP projects, XSUAA (C) is the SAP Authorization and Trust Management Service that you explicitly bind and configure via xs-security.json - it defines scopes, role templates, and role collections that CAP integrates with natively for authorization enforcement. SAP Cloud Identity Services (D) enables trust federation (e.g., SAML/OIDC with an Identity Authentication tenant), allowing you to manage identity providers and trust relationships at the BTP subaccount level, which directly affects how CAP apps authenticate users.

A is wrong because mta.yaml is a deployment descriptor - while it can reference role collection assignments, it is not a tool for configuring authorization or trust management logic itself. B is wrong because predefined BTP platform roles govern access to BTP cockpit services, not your CAP application's authorization model.

Memory tip: Think "XSUAA secures, IAS federates" - XSUAA is the runtime authorization engine inside your CAP app, while SAP Cloud Identity Services (IAS) is the trust layer that tells BTP who the user is before XSUAA decides what they can do.

No community discussion yet for this question.